Hide Forgot
It was found that Red Hat JBoss Core Services incorrectly included CVE-2016-3705 as resolved in Apache HTTP 2.4.23 (erratum RHSA-2016:2957). The release did not include the fix to libxml2, leaving it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for CVE-2016-3705.
Are there any details available for this? Upsteam bug, commit reference?
(In reply to Salvatore Bonaccorso from comment #2) > Are there any details available for this? Upsteam bug, commit reference? Referring to https://bugzilla.redhat.com/show_bug.cgi?id=1408302#c4
Hi Adam Thanks for the information here and in the related bugs. I guess there is though some confusion around the CVEs. E.g. then SuSE is tracking that CVE for https://bugzilla.novell.com/show_bug.cgi?id=1017497 . Regards, Salvatore
> Thanks for the information here and in the related bugs. I guess there is > though some confusion around the CVEs. E.g. then SuSE is tracking that CVE > for https://bugzilla.novell.com/show_bug.cgi?id=1017497 . Thank you for notifying us about that, Salvatore. I put the comment in Suse bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=1017497#c18
This CVE id is for the same issue as CVE-2016-3705 (bug 1332443). This additional CVE was assigned because the original issue was listed as fixed in RHSA-2016:2957 for the Red Hat JBoss Core Services: https://rhn.redhat.com/errata/RHSA-2016-2957.html However, that erratum actually failed to include the fix for the issue. Therefore, this new CVE is specific to the Red Hat JBoss Core Services product and is better described as: missing/incorrect fix for CVE-2016-3705 in the Red Hat JBoss Core Services.
Hi, Waiting for a fix on this CVE. As the bug status is still 'NEW', would like to know if we getting the complete fix for this CVE. If yes please share when. Thanks, Tanaya
JBCS 2.4.29 RHSA-2018:2486 includes rebased libxml2 to 2.9.7 which addresses this CVE and CVE-2016-9596.
Can anyone please specify the version in which this issue is fixed or mention it in the "target milestone" field?
(In reply to Tanaya Patil from comment #20) > Can anyone please specify the version in which this issue is fixed or > mention it in the "target milestone" field? It seems the previous comment already answers your question, doesn't it?